Set up YOURLS for Slug
Prepare a private YOURLS installation, find its API signature, and connect it to Slug without handing your links to another shortening service.
- Difficulty
- Intermediate
- Requires
- YOURLS over HTTPS
- Updated
- August 2026
On this page
Before you start
Slug is the client, and YOURLS is the server. Slug connects to a YOURLS installation that you control. If you already have a private YOURLS server working over HTTPS, skip to Find your signature.
What you need
- A domain or subdomain for short links
- Web hosting that meets YOURLS’ current requirements
- A MySQL or MariaDB database
- HTTPS with a valid certificate
- Permission to administer the server
YOURLS currently documents PHP 8.1 or newer, MySQL 5.5 or newer or MariaDB 10.0 or newer, and the PHP cURL extension for API use. Confirm the current requirements before installing.
Install YOURLS
Use the latest stable release, not the development branch. Hosting environments differ, so use your provider’s tools or the official instructions. The reliable manual path is:
- Download the latest release archiveUse the current stable package from YOURLS rather than a snapshot of the development branch.
- Create a databaseGive YOURLS a dedicated MySQL or MariaDB database and a user limited to that database.
- Create your configurationCopy
user/config-sample.phptouser/config.php, then add the database, site, and login values. - Upload the filesPlace the release in the web root for your short-link domain and apply the permissions your host recommends.
- Run the installerOpen
https://go.example.com/admin/and follow the installation prompts.
define( 'YOURLS_DB_USER', 'yourls_db_user' );
define( 'YOURLS_DB_PASS', 'use-a-unique-password' );
define( 'YOURLS_DB_NAME', 'yourls' );
define( 'YOURLS_DB_HOST', 'localhost' );
define( 'YOURLS_SITE', 'https://go.example.com' );
define( 'YOURLS_PRIVATE', true );
$yourls_user_passwords = array(
'admin' => 'use-another-unique-password',
);
Keep the installation private.
Slug uses your private YOURLS API. Don’t expose the admin area publicly, reuse passwords, commit config.php to source control, or continue without HTTPS.
Find your signature
Use a signature instead of your password. Sign in to the YOURLS admin area and open Tools, then copy the secret signature token shown in the passwordless API section. The signature is tied to your YOURLS user and can make API requests without exposing your login password.
No signature visible?
Your YOURLS installation may be set up as public. Signature tokens are available for private installations that use login credentials.
Connect Slug
- Open Slug’s settingsChoose the YOURLS server or connection option.
- Enter the server URLUse the HTTPS address where YOURLS is installed, such as
https://go.example.com. Don’t paste an admin-page URL. - Paste the signature tokenUse the token from the YOURLS Tools page, and treat it like a password.
- Test and saveSlug checks the API connection before saving the server.
Behind the scenes, YOURLS answers API requests through yourls-api.php. Slug handles the API path and request format for you.
Troubleshooting
If the connection test fails:
Slug can’t reach the server
Open the YOURLS admin page in Safari on the same device. Confirm the URL is correct, HTTPS is valid, and a firewall or host rule isn’t blocking the request.
The server returns “unauthorized”
Copy the signature again from YOURLS Tools. Make sure it belongs to an active user on this installation and has no extra spaces.
The API path returns 404
Confirm that yourls-api.php exists at the root of the YOURLS installation, and that the server’s rewrite and PHP configuration match the official server guide.
The signature option is missing
Confirm YOURLS_PRIVATE is set to true. Public installations don’t provide user signature tokens.
Maintenance
- Install stable YOURLS updatesFollow the official upgrade instructions.
- Back up the database and the user folderBoth hold your links and configuration.
- Keep the server currentUpdate PHP, the database, the web server, and TLS certificates.
- Protect config.phpRestrict access with the permissions your host supports.
- Rotate the signature if it’s exposedGenerate a new one in YOURLS, then update Slug.